Severity
High
Analysis Summary
CVE-2024-22454 CVSS: 8.8
Dell PowerProtect Data Manager could allow a remote attacker to gain elevated privileges on the system, caused by the inclusion of a weak password recovery mechanism for forgotten passwords. An attacker could exploit this vulnerability to retrieve the reset password token without authorization and then perform the password change.
CVE-2024-22445 CVSS: 7.2
Dell PowerProtect Data Manager could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by an OS command injection vulnerability. An attacker could exploit this vulnerability to execute arbitrary commands on the system with the privileges of the application.
Impact
- Privilege Escalation
- Gain Access
Indicators Of Compromise
CVE
- CVE-2024-22454
- CVE-2024-22445
Affected Vendors
Dell
Affected Products
- Dell PowerProtect Data Manager 19.10
- Dell PowerProtect Data Manager 19.11
- Dell PowerProtect Data Manager 19.12
- Dell PowerProtect Data Manager 19.15
Remediation
Refer to Dell Security Advisory for patch, upgrade, or suggested workaround information.